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(57)Abstract: 

PROBLEM TO BE SOLVED: To provide a computer 
virus occurrence detecting device, method and program 
capable of early detecting occurrence of computer virus 
on a network to prevent the infection damage by 
computer virus on a computer network or computer 
system that is an object of security protection. 
SOLUTION: This computer virus occurrence detecting 
device 3 early detects whether a computer virus has 
occurred on Internet 1 or not as the computer virus 
remains unspecified. Namely, the occurrence of 
computer virus is detected in a state before the kind or 
mechanism is clarified and countermeasure data such as 
vaccine is provided, or an unknown computer virus state. 
For such a detection, this device is constituted to 
collect specific data showing the probability of 
occurrence of computer virus. The specific data is 
formed of data showing the occurrence of imperfect 
packet, abnormal increase in communication quantity, 
abnormal increase in error quantity, or the like, which is 

caused by a TCP/IP communication using an exceptional port generally not used or an 
abnormal TCP/IP communication. 
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